# SCAN IRQ effective-affinity failure and controlled queue activation

## Authenticated v2 attempt retained

The queued terminal repair worked: the second user invocation reached the root
setter. Its receipt is
`~/archive/libhft/scan-nic-irqs-20261010T164524Z-2316709/` on SCAN. The first
planned move, IRQ99 from CPU10 to CPU0, failed the one-second effective-affinity
check. The setter restored its original requested mask and reported
`applied=false`, with no reported rollback write error. The wrapper retained
its failed status and after audit; all twenty wrong Mellanox IRQs remain on
isolated CPUs10–19. The complete original seven receipt files are preserved
under [v2-failed-receipt](evidence/scan-irq-activation-20261010/v2-failed-receipt/apply.json),
without rewriting their grades or the original source capsule.

SCAN runs `5.14.0-687.44.1.el9_8.x86_64`, with generic pending IRQ support enabled;
generic IRQ debugfs support is disabled. Upstream 5.14's
[affinity setter](https://github.com/torvalds/linux/blob/v5.14/kernel/irq/manage.c#L263)
can accept a requested mask as pending, and its
[proc readback](https://github.com/torvalds/linux/blob/v5.14/kernel/irq/proc.c)
distinguishes pending requested masks from effective masks. An idle queue is
therefore a plausible explanation for the failed immediate readback. This is an
inference, not proof of the running vendor kernel's exact execution path. The v2
setter did not capture the requested mask immediately after its write. No IRQ
injection, driver reload, link reset, queue-count change or new namespace is used.

## Separately prepared v3 generation

The public cold setter now records requested/effective masks immediately after
each write and accepts an optional site callback to exercise an idle queue. Its
default CLI performs no activation. It refreshes IRQ identity before each write,
keeps original masks and rolls back on activation exceptions. A supplied
activation cannot substitute for an actual effective-affinity readback. Deferred
rollbacks use the same callback and verify the original effective mask.

The private SCAN helper verifies the two existing DAC namespace addresses,
distinct declared on-link peers, physical PCI pair, up links and direct routes
before any affinity writes. When a requested mask is accepted but its effective
mask differs, it sends exactly two ICMP packets from the queue's original CPU on
the matched physical port. Each command has a three-second subprocess limit,
and ping has a two-second deadline. It retains the selected IRQ's before/after
per-CPU counters, action identity, packet command/output and actual counter delta.
A passing ping without that IRQ's activity is refused. Counter reset, changed
identity or malformed topology cannot report activation success. The outer
high-priority isol-no-shared lease and 120-second deadline remain unchanged.

Twenty-four fixture tests pass locally and on SCAN under a high-priority shared
lease, **zero skips**: ten setter/rollback cases, six topology/counter cases and
eight detached-terminal wrapper cases. All host/root/traffic/write operations in
those tests are fixtures; no live ICMP packet or IRQ write is part of this source
qualification. Earlier assertions and failed receipts remain retained. The
[verifier](evidence/scan-irq-activation-20261010/verify.py) binds ten source/support
files and checks the original failure and actual SCAN test receipt.

The home wrapper now selects:

`/home/yann/.cache/libhft/scan-benchmark-irq-policy-v3-f27b3af735d6`

Seal: `f27b3af735d6de2f968629259815916e0ddc290163ce91c914990d651fde440b`.

All staged hashes, the byte-identical installed load profile and both shell
syntax checks pass. This is a separately prepared activation diagnostic, with
**live application pending** the user's sudo invocation. Success still requires
actual effective readback for every changed IRQ and the final complete audit.
No timing, SDK, full-session, release or historical ranking promotion is inferred.
After a successful application, the nonpersistent setting needs readback after
boot/driver/queue changes and a fresh matched baseline before timing comparisons.

The original v1/v2 operational capsules and both failed runs remain intact.
No Stage2 recipe/adapter/runtime, source pin, canonical wire, shared clock/build/
layout API, installed SDK payload or another session's job is changed.

Seven completed inert source files are sealed and individually hash-verified in
`~/archive/libhft/codex-llfix-reference-20261010/scan-irq-activation1/` on SCAN
before deleting their exact owning build directory. The
[retention receipt](evidence/scan-irq-activation-20261010/retention.json) retains
the archive seal and verified cleanup. All three operational capsules remain.

## Successful live application and independent readback

The user's v3 invocation completed successfully at 17:53 UTC on 2026-10-10.
Its original seven receipt files are preserved byte-for-byte under
[applied](evidence/scan-irq-activation-20261010/applied/run-status.json), from
`~/archive/libhft/scan-nic-irqs-20261010T175324Z-2354179/` on SCAN. The wrapper
reports `stage=complete`, return code zero and `configuration_verified=true`.
The preceding pending statement describes preparation at its original pin;
this separate continuation records the completed privileged application.

All twenty planned moves succeeded: IRQs 99–108 and 118–127 moved from CPUs 10–19
to housekeeping CPUs 0–9. Each requested mask was accepted while the effective
mask initially remained on its original CPU. Each selected queue then received
two actual interrupts during its two-packet ICMP activation: the per-CPU
counters increased once on the old CPU and once on the target CPU. Effective
readback adopted the target. This establishes the observed deferred move;
it does not qualify the running vendor kernel's exact internal source path.
There were no rollbacks or rollback errors.

Both the wrapper's after audit and an independent read-only audit at 17:55 UTC
report zero issues. All 42 Mellanox IRQs have nonempty effective affinities
entirely within CPUs 0–9; the other 22 placements remain unchanged. Isolated
CPUs 10–19, the installed load-profile bytes, busy-read/poll 50 and the two existing
namespace/physical-port bindings are preserved. Separate readback captures
performance governors on benchmark CPUs 10 and 15. The source capsule's six
hashes and its original seal still verify.

The [applied receipt verifier](evidence/scan-irq-activation-20261010/applied/verify.py)
checks the original receipt hashes, all twenty moves and per-CPU activity,
all 42 final placements, the independent readback and unchanged policy. The
source/staging verifier retains its original `configuration_applied=false`
grade; the new applied proof records configuration success separately. Both
earlier failed runs and their operational capsules remain intact.

The setting remains **nonpersistent**: recheck effective affinities after a
reboot, driver reset or queue change. No benchmark was run in this continuation.
The ICMP activation times are diagnostics, not latency results. A fresh matched
baseline is needed for subsequent timing comparisons; old results and rankings
keep their original machine/source grades.